andy-mcp: first Matias dogfood — connection list 403 and no media upload

[JorgeMenaDev]

First live publish through andy-post (2026-08-13, Matias on T3 Grok). Post succeeded. Two MCP gaps forced workarounds.

What worked

• manage_post create with channel=x, text, connectionId, and mediaAssetId published to X in seconds.
• Workspace API key with content:read + content:write is enough for list/create.

Gaps

1. list_connections 403 unless the key has content:connections. get_context.connections is empty with connectionsCompleteness: not_authorized. Agents recover connectionId from an old list_posts row.
2. No media tools on MCP. Image posts need HTTP content.media.upload_prepare → PUT → upload_complete, then mediaAssetId on create.
3. T3 Grok does not inherit Clerk-OAuth Andy tools. Hosts that only inherit static-token MCP servers need a workspace key client.

Expected

• A posting key can list destinations by human label.
• An operator-supplied image can be attached without leaving MCP.

Evidence

• get_context requestId mcp-46cd72a8-302e-4400-93bd-257e8af10b4a
• list_connections 403 requestId mcp-a44b4eeb-a728-4702-b878-786536b4df5c
• Successful create v97dx7wshk4587mctrrd06vm958ccn5s requestId mcp-8566d75d-5a6b-46e6-9d6f-6ed6e63fbaa7

Product follow-up belongs on Andesphere/andyChat (private). This issue is the public dogfood record.